Tick 'Configure the following audit events:', and 'Success', then click on to save the setting. Select 'Detailed Tracking', and on the right-hand side, double-click on 'Audit Process Creation' to bring up the properties dialog. To do this, run Local Security Policy editor (in 'Control Panel'->'Administrative Tools') as Administrator (right-click on its icon and select 'Run as Administrator'), and expand the left-hand tree 'Advanced Audit Policy Configuration'->'System Audit Policies'->'Detailed Tracking'. If your version of Windows allows you to run Local Security Policy or Local Group Policy editor, you can enable advanced audit logging of process start and stop in the system, and the next time it occurs, look in the Security event log to see what process was launched.
